In the contract between the controller and processor for the processing of personal data, which of the options below represents the sole responsibility of the Controller?

In the contract between the controller and processor for the processing of personal data, which of the options below represents the sole responsibility of the Controller?
A . Erase all personal data after the completion of treatment-related services, deleting existing copies.
B . Treat personal data only through documented instructions, including with regard to data transfers to third countries or international organizations.
C . Ensure that the persons authorized to process personal data have made a commitment to confidentiality.
D . Apply technical and organizational measures to ensure that only personal data that are necessary for each specific purpose of processing are processed.

View Answer

Answer: D

Explanation:

The correct option is exclusively for the Controller, the others are for the Processor in accordance with Articles 25 and 28 of the GDPR.